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Overview of the DMCA (17 USC § 1201) 

* Prohibits "circumv/ention" of 
"technologcal protection measures" 

* In other words— DRM protecting 
copyri^ited works 

* Various remedies 

* Injunction 

* Devices impounded, modified or destroyed 

* Monetary damages (can be tripled for repeat offenders) 

* Defendant may pay plaintiff's costs and attorneys fees 


* criminal penalties 

* VN^IIful violations 

* For commercial advantage or private financial gain 
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Overview of the DMCA (17 USC § 1201) 

Addresses Two Different Kinds Of DRM 


• Measures that "effectively control access to a 
work" 


* Measures that "effectively protect the ri^it of 
a copyri^it owner"— i.e. protects against copying 


* Afferent scope of liability for these different 
types of techno! oges 
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* "Access Control 



* r^bnufacturers and distributors of technology 
which circumx/ents access controls 

* USERS of technology which circumvents access 
controls 
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"Copy Control" Measures— who faces 


* Only manufacturers and distributors of technology 
which circumvents copy controls 
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"Access Control " Measures 


"Effectively controls access to a work" 
means: 


"in the ordinary course of its op&~atioi% 
reqiares the a/^ication of information, or 
a process or treatment, with the aiAhority 
of the copyri^Tt owner, to gain access to 
the work" 
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"Access Control " Measures 


Selecting A Strong 
DRM System 

O/erview of 
The DMCA 


'"Access control" measures completely 
prevent any experience of the work 


"Access Control" 
Measures 


* Encryption is often a feature 


"Copy Control" 
Measures 

"Q rcumvention" 
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* Examples: 

* CSS encryption and authentication for D\ZDs 

* Authentication handshake between PC and server 

* Regon codes and authentication codes on 

* Authentication codes on game discs 
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"Access Control " Measures 


* Must "effectively" control access 

* If content easily obtained— measure does 
not "effectively" control access 

* This is why encryption is important 

* But, if unauthorized conduct leads to 
weakening of systenrv may still be 
considered "effective" 
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Selecting A Strong 
DRM System 

O/erview of 
The DMCA 

"Access Control" 
Measures 

"Copy Control" 
Measures 

"Q rcum\/ention" 


"Effectively protects a ri^it of a copyri^it 
owner [under the Copyri^it Act]" means: 

"the mBasire, i n the ordi nary course of its 
operation, prevents, restricts^ or otherwise 
iimits the exercise of a ri^it of a copyright 
owner. . 
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"Copy Control" Measures 

Select! nq A Stronq 
DRMSs^em 

* "Copy control" measures do not restrict 
initial experience of the work 

O/erview of 
The DMCA 

"Access Control" 
Measures 

* Rather, they limit what can be done with a 
work thereafter 

"Copy Control" 
Measures 

"Q rcum\/ention" 

* For example, may limit ability to reproduce, 
distribute, print, perform or display a work 

M ni nrizi IX] The 
RiskOf DRM 

Obtaining User 
Consent 

Use Care In 
V\ihat You Say 

* Examples: 

* D\/D vyatermarks 

* Adobe eBook use restrictions 

* |N/bcrovision Analog Copy Protection 
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"Copy Control" Measures 

Select! nq A Stronq 
DRMSs^em 

O/erview of 
The DMCA 

• Copy control measures may be intertwined 
with access control measures 

"Access Control" 
Measures 

"Copy Control" 
Measures 

* Like access controls— copy controls must 
"effectively" protect the copyri^it 

"Q rcum\/ention" 

M ni nrizi IX] The 
RiskOf DRM 

* Content containing embedded "copying' 
preferences of the owner, but which does 
not enforce them is not effective 

Obtaining User 
Consent 


Use Care In 
V\ihat You Say 
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"Circum\/ention" 

* To circum\/ent an access control measure: 

"to descramble a scrambled i/york^ to decrypt an 
encrypted v\fork, or othenAfise to av€>id, bypass, 
remo\/e, deactl^/ate, or Impair a technolo^cal 
measure, vsnthout the authority of the copyright 
o\A/ner" 

• To circunnvent a copy control measure: 

"av€Mdlng^ bypassings remo\nng deactl^/atlngs or 
othenA/lse Impairing a technolo^cal measure" 
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"Circum\/ention" 

* The troublesome issue of passuuords 

* Basra/uord authentication regmes are clearly 
"access control" measures as defined by the 
DMCA 

* However, two courts have found that an 
unauthorized party obtaining access to and 
using passwords (to gain access to websites) is 
not "circumvention" 

* Hard to see how this is different from 
obtaining access to and using CSS keys in the E>e- 
CSS software— found to constitute circumvention 
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* So, you have your robust DRM 

* You're protecting your killer content! 

* But your customers say that it broke their CE>- 
ROM drive 

* And they sue you . . . 


MnimizingThe 
Risk Of DRM 

Obtaining User 
Consent 


Use Care In 
V\ihat You Say 



o 




IvfnimizingThe RiskOf DRM 

Select! nq A Stronq 
DRMSs^em 

O/erview of 
The DMCA 

* A number of recent lawsuits by users claim 
that DRM harmed their computers or other 
interests 

"Access Control" 
Measures 

"Copy Control" 
Measures 

* EXsputes turned on two key issues: 

"Q rcum\/ention" 

* Alleged lack of user consent 

M ni nrizi IX] The 
RiskOf DRM 

Obtaining User 
Consent 

* Alleged affirmative misstatements about the 
nature of the DRM systems 

Use Care In 
V\ihat You Say 
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IvfnimizingThe RiskOf DRM 


User Consent 


* End-user license must be accepted before E)RM 

Select! nq A Stronq 
DRMSs^em 

installed 

O/erview of 


The DMCA 

* In the license, disclose the general nature of 

"Access Control" 
Measures 

the DRM system 

"Copy Control" 


Measures 

* E)isclose in reasonable detail potentially 

"Q rcum\/ention" 

contentious items 

M ni nrizi IX] The 
RiskOf DRM 

* Low level drivers installed? 

* Collects or transmits information about the user or their 

computer? 

Obtaining User 
Consent 

* Overwrites or replaces any files? 

* Anything that couid decade performance or pose risk to 

Use Care In 

hardware? 

V\ihat You Say 

* Hidden fiies? 
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MnimizingThe Risk Of DRM 

Affirmative Statements 


Selecting A Strong 
DRM System 

Overview of 
The DMCA 


* The impulse is to downplay the functionalities 
of DRM 


"Access Control" 
Measures 

"Copy Control" 
Measures 

"Q rcumvention" 


* Overly zealous "assurances" that user 
systems will not be affected can be risky 


MnimizingThe 
Risk Of DRM 


* Marketing and technical materials describing 
the system must, obviously, be accurate 


Obtaining User 
Consent 


Use Care In 
V\ihat You Say 
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